Version Packages - #1868
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | dd31b0e | Commit Preview URL Branch Preview URL |
Aug 30 2026, 04:21 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-cloud | dd31b0e | Aug 30 2026, 04:23 AM |
Contributor
Cloudflare previewTorn down — the PR is closed. |
@executor-js/cli
@executor-js/config
@executor-js/execution
@executor-js/sdk
@executor-js/codemode-core
@executor-js/runtime-quickjs
@executor-js/plugin-file-secrets
@executor-js/plugin-graphql
@executor-js/plugin-keychain
@executor-js/plugin-mcp
@executor-js/plugin-onepassword
@executor-js/plugin-openapi
executor
commit: |
RhysSullivan
force-pushed
the
changeset-release/main
branch
2 times, most recently
from
August 30, 2026 03:22
72b2c11 to
3738d12
Compare
RhysSullivan
force-pushed
the
changeset-release/main
branch
from
August 30, 2026 04:19
3738d12 to
dd31b0e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@executor-js/cli@0.2.56
Patch Changes
@executor-js/config@1.6.6
Patch Changes
@executor-js/execution@1.6.6
Patch Changes
#1866
21119daThanks @RhysSullivan! - Large execute results are measured once, not once per spanThe result-size telemetry probe serializes the whole returned value to count its characters, and that cost grows with the payload. The same result object was walked again every time it was stamped onto another span: an operator-approved run measured it twice (inner and outer span), and every retried
resumethat replayed a settled outcome measured it again. The measurement is now computed once per result object and reused, so a large result pays one size walk no matter how many spans report it. Response text, structured content, and span attribute values are unchanged.Updated dependencies []:
@executor-js/vite-plugin@0.0.66
Patch Changes
@executor-js/runtime-quickjs@1.6.6
Patch Changes
@executor-js/plugin-desktop-settings@1.6.6
Patch Changes
@executor-js/plugin-example@1.6.6
Patch Changes
@executor-js/plugin-file-secrets@1.6.6
Patch Changes
@executor-js/plugin-graphql@1.6.6
Patch Changes
9a1fbd5]:@executor-js/plugin-keychain@1.6.6
Patch Changes
@executor-js/plugin-mcp@1.6.6
Patch Changes
#1869
c695970Thanks @RhysSullivan! - Explain macOS permissions for Codex plugins instead of failing with an opaqueerror. A refused grant used to surface as
Internal tool error [id]— theplugin reports "Unknown error" and only a numeric code says what happened, so
neither the user nor the model could tell that macOS was the blocker.
The bridge now recognises those codes and answers with the grant to enable and
where to find it. Each plugin's add screen also states what macOS will ask for
before anything runs, with a link straight to the right Privacy pane — macOS
asks once, and a dismissed prompt never returns.
The add screen checks that access when it opens, and holds the Add button
until the plugin answers. Adding one that macOS is still blocking produced an
integration that looked connected and failed on its first call, by which point
the screen explaining the fix was gone.
Updated dependencies [
9a1fbd5]:@executor-js/plugin-onepassword@1.6.6
Patch Changes
9a1fbd5]:@executor-js/plugin-openapi@1.6.6
Patch Changes
9a1fbd5]:@executor-js/plugin-toolkits@1.5.41
Patch Changes
9a1fbd5]:@executor-js/sdk@1.6.6
@executor-js/codemode-core@1.6.6
executor@1.6.6
Patch Changes
#1869
c695970Thanks @RhysSullivan! - Explain macOS permissions for Codex plugins instead of failing with an opaqueerror. A refused grant used to surface as
Internal tool error [id]— theplugin reports "Unknown error" and only a numeric code says what happened, so
neither the user nor the model could tell that macOS was the blocker.
The bridge now recognises those codes and answers with the grant to enable and
where to find it. Each plugin's add screen also states what macOS will ask for
before anything runs, with a link straight to the right Privacy pane — macOS
asks once, and a dismissed prompt never returns.
The add screen checks that access when it opens, and holds the Add button
until the plugin answers. Adding one that macOS is still blocking produced an
integration that looked connected and failed on its first call, by which point
the screen explaining the fix was gone.
Updated dependencies [
9a1fbd5]:@executor-js/cloud@1.4.67
Patch Changes
#1864
fad3650Thanks @RhysSullivan! - API key validation is cached per isolateEvery MCP request and every API-key-authenticated
/api/*request used to pay a live WorkOS round trip (~100-150ms) to validate the presented key, on every single request. The JWT bearer path beside it already verified locally against a JWKS cached for an hour; API keys had no cache at all.Successful validations are now cached in a bounded per-isolate map for 60 seconds, keyed by the SHA-256 digest of the key value (never the raw credential). The MCP handler used to rebuild its whole auth layer (and with it the cache) on every request; it now builds the layer once per isolate, so the cache holds on both the
/api/*and/mcpplanes. Invalid keys and upstream failures are never cached, so probing bad keys cannot pollute the map and a freshly created key works immediately. The tradeoff: a revoked key remains usable for up to 60 seconds within an isolate that validated it before revocation — far tighter than the one-hour rotation window the JWT path already accepts.Updated dependencies [
c695970,21119da,9a1fbd5]:@executor-js/host-selfhost@0.0.48
Patch Changes
c695970,21119da,9a1fbd5]:@executor-js/local@1.6.6
Patch Changes
#1865
9a1fbd5Thanks @RhysSullivan! - Desktop OAuth connects finish the moment the provider redirectsWhen the desktop app runs an OAuth flow in the system browser, the app learned about completion by polling the local server once a second. The completed result sat in memory while the user watched the "Connecting…" spinner for up to a second more — about half a second wasted on average, on every connect.
The await endpoint now long-polls: the server holds the request open (up to 25 seconds per hold) and answers the instant the flow completes. The client polls one request at a time and reconnects after each answer, so requests never stack. Mixed versions stay compatible in both directions: an old client still gets its answer within one poll of a new server, and a new client against an old server behaves exactly as before.
Updated dependencies [
c695970,21119da,9a1fbd5]:@executor-js/e2e@0.0.46
Patch Changes
c695970]:@executor-js/example-all-plugins@0.0.67
Patch Changes
c695970]:@executor-js/example-docs-sdk-quickstart@0.0.52
Patch Changes
@executor-js/analytics@0.1.13
Patch Changes
21119da]:@executor-js/api@1.4.69
Patch Changes
21119da]:@executor-js/cloudflare@0.0.48
Patch Changes
21119da]:@executor-js/mcp-apps-shell@1.4.17
Patch Changes
9a1fbd5]:@executor-js/runtime-workerd-subprocess@0.0.21
Patch Changes
@executor-js/onboarding-demo@0.0.1
Patch Changes
c695970,9a1fbd5]:@executor-js/plugin-encrypted-secrets@0.0.48
Patch Changes
@executor-js/plugin-provider-service-split@0.0.20
Patch Changes
@executor-js/react@1.4.69
Patch Changes
#1865
9a1fbd5Thanks @RhysSullivan! - Desktop OAuth connects finish the moment the provider redirectsWhen the desktop app runs an OAuth flow in the system browser, the app learned about completion by polling the local server once a second. The completed result sat in memory while the user watched the "Connecting…" spinner for up to a second more — about half a second wasted on average, on every connect.
The await endpoint now long-polls: the server holds the request open (up to 25 seconds per hold) and answers the instant the flow completes. The client polls one request at a time and reconnects after each answer, so requests never stack. Mixed versions stay compatible in both directions: an old client still gets its answer within one poll of a new server, and a new client against an old server behaves exactly as before.
Updated dependencies []:
@executor-js/desktop@1.6.6